BGP配置与排错.ppt

BGP配置及其排错,2003,CiscoSystems,Inc.Allrightsreserved.,1,BGP掌控着Internet上十多万条路由，之所以这么强悍是因为其深谙无为而治的道理，IGP的协议都有着非常复杂的路由算法（SPF/DUAL）,看上去很美的算法反而束缚了这些协议的施展空间，BGP没有算法，有的是可以随心所欲控制的规则（属性）可怜的IGP不仅要被人鄙视，还要被霸道的BGP利用，它们一方面要为BGP牵线搭桥建立邻居关系，另一方面他们辛苦学习来的路由还要遭受BGP随心所欲的玩弄（控制）。相对于IGP而言，BGP协议的精髓在于对路由的控制，而不是学习路由。,2003,CiscoSystems,Inc.Allrightsreserved.,2,BGP何以如此强大？,2003,CiscoSystems,Inc.Allrightsreserved.,3,BGP高度总结,邻居：用loopback接口创建(update-sourceloopback)，保证邻居的可靠冗余IBGP:两个地址之间有路由即可。有两大问题同步问题（只要规划合理，nosynchronization）水平分割问题解决方案有三个FULL-MESHIBGP（开销太高）RouteReflector（路由反射器）RouteConfederence（路由联盟）EBGP:如果不直连，用静态路由提供IP连接并且修改TTL值（ebgp-multihop255）下一跳：不需要直连，但必须通过IGP可达默认情况，是指的到达下一个AS的最佳入口地址，当不可达时(Next-HoP-Self),控制数据包的出口路径（在inbound方向的路由上设置）WeightLocal-Preference控制数据包的入口路经（在outbound方向的路由上设置）As-PathprependMedCommunity,策略控制,Access-Listfilter(最传统的控制方法，不灵活)Prefix-Listfilter（可以直接引用在Neighbor上，也可以被distribute-list以及route-map调用）AS-pathfilter（可以被filter-list或者route-map调用）Community-listfilter（可以被route-map调用）Distribute-List(只过滤不做属性控制)Route-Map（过滤，属性控制）强烈推荐：对于IGP协议,用prefix-list定义路由，通过Distribute-List掉用进行路由过滤。对于BGP协议，用Prefix-List,As-PathListCommunity-list定义路由，再通过route-map进行调用,2003,CiscoSystems,Inc.Allrightsreserved.,5,汇总,Networkx.x.x.xx.x.x.x（对IGP路由进行汇总宣告此路由必须在路由表中有一个精确匹配的路由）属于虚假汇总，需要创建指向null0的静态路由Aggregatex.x.x.xx.x.x.x(summary-only)(as-set)真正的汇总，汇总BGP表中的路由，具体路由可以通过summary-only抑制as-set可以设置被汇总具体路由的AS编号,常见故障汇总,邻居不能建立（AS号码错误，地址不匹配，路由不可达，TTL问）Bgplog-neighbor-changeShowipbgpneighborx.x.x.xShowipbgpsummary路由丢失(next-hop无效，路由未同步，宣告的网络没有与之匹配的IGP路由，汇总时被抑制，做了错误的过滤)Showipbgp(x.x.x.x)(longer)Showiproute(x.x.x.x)(longer)SHOWIPBGPNEIGHBORX.X.X.XADVERTISED-ROUTESSHOWIPBGPNEIGHBOTX.X.X.XRECEIVED-ROUTESSHOWIPBGPNEIGHBORX.X.X.XROUTES（需要命令neighborsoftreconfiguration）DEBUGIPBGPDEBUGIPBGPX.X.X.XUPDATEDEBUGIPBGPEVENTSClearipbgp（softin）Clearipbgp(softout),BGP基本概念/基本配置回顾BGP路由属性及其策略选路BGP汇总配置BGP过滤配置BGP故障排除,BGPCharacteristics,BGPisadistance-vectorprotocolwiththefollowingenhancements:Reliableupdates:BGPrunsontopofTCP(port179)Incremental,triggeredupdatesonlyPeriodickeepalivemessagestoverifyTCPconnectivityRichmetrics(calledpathvectorsorattributes)Designedtoscaletohugeinternetworks(e.g.,theInternet),BGPCharacteristics(Cont.),ReliableUpdatesUseTCPastransportprotocolNoperiodicupdatesPeriodickeepalivestoverifyTCPconnectivityTriggeredupdatesarebatchedandrate-limitedevery5secondsforinternalpeerevery30secondsforexternalpeer量太大，批量更新,BGPDatabases,Neighbortable（必须双向手工创建）ListofBGPneighborsShowipbgpneighbor（summary）BGPforwardingtable/database（不是包含所有路径）ListofallnetworkslearnedfromeachneighborCancontainmultiple（不是所有）pathwaystodestinationnetworksDatabasecontainsBGPattributesforeachpathwayShowipbgpIProutingtableListofbestpathstodestinationnetworksShowiproute,BGPCommands,routerbgpautonomous-system,Router(config)#,Thiscommand,withnosubcommands,doesnotactivateBGP.（对BGP而言Network命令不是必须的）OnlyoneinstanceofBGPcanbeconfiguredontherouteratasingletime.Theautonomoussystemnumberidentifiestheautonomoussystemtowhichtherouterbelongs.Theautonomoussystemnumberinthiscommandiscomparedtotheautonomoussystemnumberslistedinneighborstatementstodetermineiftheneighborisaninternalorexternalneighbor.,BGPneighborCommand,neighborip-address|peer-group-nameremote-asautonomous-system,Router(config-router)#,TheneighborcommandactivatesaBGPsessionwiththisneighbor.Thetermremote-asshowswhatASthisneighborisin.ThisASnumberisusedtodetermineiftheneighborisinternalorexternal.Thiscommandisusedforbothexternalandinternalneighbors.TheIPaddressspecifiedisthedestinationaddressofBGPpacketsgoingtothisneighbor.ThisroutermusthaveanIPpathwaytoreachthisneighborbeforeitcansetupaBGPrelationship.（IGP对BGP的贡献之一提供TCP连接的路经）,Example:BGPneighborCommand,BGPIssueswithSourceIPAddress,WhencreatingaBGPpacket,theneighborstatementwillbethedestinationIPaddressandtheoutboundinterfacewillbethesourceIPaddress.（有需要时可以通过Update-source修改）WhenaBGPpacketisreceivedforanewBGPsession,thesourceaddressofthepacketiscomparedtothelistofneighborstatements.Ifamatchisfound,arelationshipisestablished.Ifnomatchisfound,thepacketisignored.MakesurethesourceIPaddressmatchestheaddressthattheotherrouterhasinitsneighborstatement.,BGPNeighborUpdateSourceAddress,neighborip-address|peer-group-nameupdate-sourceinterface-typeinterface-number,Router(config-router)#,ThiscommandallowstheBGPprocesstousetheIPaddressofaspecifiedinterfaceasthesourceIPaddressofallBGPupdatestothatneighbor.Aloopbackinterfaceisusuallyused,asitwillbeavailableaslongastherouterisoperational.TheIPaddressusedinthiscommandwillbethedestinationIPaddressofallBGPupdatesandshouldbetheloopbackinterfaceoftheotherrouter.Theupdate-sourcecommandisnormallyusedonlywithIBGPneighbors.TheaddressofanEBGPneighbormustbedirectlyconnectedbydefault.TheloopbackofanEBGPneighborisnotdirectlyconnected.,Example:BGPUsingLoopbackAddresses（保证邻居关系的可靠冗余）,Example:ebgp-multihopCommand（默认情况下，EBGP邻居必须建立在同一网段上）,IBGPandRedistribution,AtransitASshouldrunIBGPonallroutersbecausethefullInternetroutingtableistoolargetoredistributeintoanIGP.（在internet上将BGP路由全部注入IGP将是一件非常恐怖的事情）,IBGPSplitHorizonRule,Bydefault,routeslearnedviaIBGPareneverpropagatedtootherIBGPpeers.,PartialMeshIGP,解决水平分割问题的三种机制Full-MeshIBGPRouteReflectorConferderence,2003,CiscoSystems,Inc.Allrightsreserved.,21,RouteReflectorSplit-HorizonRules,ClassicBGP:IBGProutesarenotpropagatedtootherIBGPpeersFullmeshofIBGPpeersisthereforerequired,RoutereflectorcanpropagateIBGProutestootherIBGPpeers.FullmeshofIBGPpeersisnolongerrequired,SplittingaTransitASwithBGPConfederations,SplittingaTransitASwithBGPConfederations,SplittingtheASintosmallerautonomoussystemswouldreducethenumberofBGPsessions,butextraASnumbersarenotavailable,SplittingtheASintosmallerautonomoussystemswouldreducethenumberofBGPsessions,butextraASnumbersarenotavailable,SplittingaTransitASwithBGPConfederations,ConfederationsenableinternalASnumberstobehiddenandannounceonlyone(external)ASnumbertoEBGPneighbors,SplittingaTransitASwithBGPConfederations,ConfederationsenableinternalASnumberstobehiddenandannounceonlyone(external)ASnumbertoEBGPneighbors,SplittingtheASintosmallerautonomoussystemswouldreducethenumberofBGPsessions,butextraASnumbersarenotavailable,SplittingaTransitASwithBGPConfederations,ConfederationsenableinternalASnumberstobehiddenandannounceonlyone(external)ASnumbertoEBGPneighbors,SplittingtheASintosmallerautonomoussystemswouldreducethenumberofBGPsessions,butextraASnumbersarenotavailable,SplittingaTransitASwithBGPConfederations,ConfederationsenableinternalASnumberstobehiddenandannounceonlyone(external)ASnumbertoEBGPneighbors,SplittingtheASintosmallerautonomoussystemswouldreducethenumberofBGPsessions,butextraASnumbersarenotavailable,AS-PathPropagationWithintheBGPConfederation,IBGPsessionASpathisnotchangedIntraconfederationEBGPsessionIntraconfederationASnumberisprependedtoASpathEBGPsessionwithexternalpeerIntraconfederationASnumbersareremovedfromtheASpathExternalASnumberisprependedtotheASpath,AS-PathPropagationWithintheBGPConfederation(Cont.),AS-PathProcessinginBGPConfederations,IntraconfederationASpathisencodedasaseparatesegmentoftheASpathDisplayedinparentheseswhenyouareusingCiscoIOSshowcommandsAllrouterswithintheBGPconfederationhavetosupportBGPconfederationsArouternotsupportingBGPconfederationswillrejectASpathwithunknownsegmenttype,IntraconfederationEBGPSessionProperties,BehaveslikeEBGPsessionduringsessionestablishmentEBGPneighborhastobedirectlyconnected,oryouhavetoconfigureebgp-multihopontheneighborBehaveslikeIBGPsessionwhenpropagatingroutingupdatesLocalpreference,MEDandnext-hopattributesareretainedThewholeconfederationcanrunoneIGP,givingoptimalroutingbasedonnext-hopattributeinBGProutingtable,RoutingIssueswithoutFullyMeshedIBGP,RouterCwilldropthepackettonetwork10.0.0.0.RouterCisnotrunningIBGP;therefore,ithasnotlearnedabouttheroutetonetwork10.0.0.0fromrouterB.（C会扔弃数据包，但F根本不知道C的情况，所以会不停的把数据包发往C,这就是著名的路由黑洞）Inthisexample,routerBandrouterEarenotredistributingBGPintoOSPF.,BGPSynchronization,Synchronizationrule:DonotuseoradvertisetoanexternalneighboraroutelearnedbyIBGPuntilamatchingroutehasbeenlearnedfromanIGP.AvoidsblackholeswithintheASSafetoturnoffifallroutersintheASarerunningfull-meshIBGP,nosynchronization（同步规则是用来指导和约束BGP规划和配置，以避免路由黑洞的发生，只要我们能确保黑洞不会发生，我们就可以关闭同步。类似于现实生活中的法律，如果我们遵纪守法，我们不用担心法律的制裁）,Router(config-router)#,DisablesBGPsynchronizationsothatarouterwilladvertiseroutesinBGPwithoutlearningtheminIGP,BGP基本概念/基本配置回顾BGP路由属性及其策略选路BGP汇总配置BGP过滤配置BGP常见排错,BGPPathAttributes,BGPmetricsarecalledpathattributesBGPattributesarecategorizedaswell-knownandoptionalWell-knownattributesmustberecognizedbyallcompliantimplementationsOptionalattributesareonlyrecognizedbysomeimplementations(couldbeprivate),expectednottoberecognizedbyeveryone,Well-KnownBGPAttributes,Well-knownattributesaredividedintomandatoryanddiscretionaryMandatorywell-knownattributesmustbepresentinallupdatemessagesDiscretionarywell-knownattributesareoptional,theycouldbepresentinupdatemessagesAllwell-knownattributesarepropagatedtootherneighbors,Well-KnownBGPAttributes(Cont.),MandatoryWell-KnownAttributesOriginSpecifiestheoriginofaBGProuteIGPRouteoriginatedinanIGPEGPRouteoriginatedinEGPUnknownRoutewasredistributedintoBGPAS-pathSequenceofASnumbersthroughwhichthenetworkisaccessibleNext-hopIPaddressofthenext-hoprouter,Well-KnownBGPAttributes(Cont.),DiscretionaryWell-KnownAttributesLocalpreferenceUsedforconsistentroutingpolicywithinASAtomicaggregateInformstheneighborASthattheoriginatingrouteraggregatedroutes,OptionalBGPAttributes,OptionalBGPattributesaretransitiveornontransitiveTransitiveoptionalattributesPropagatedtootherneighborsifnotrecognized;partialbitsettoindicatethattheattributewasnotrecognizedNontransitiveoptionalattributesDiscardedifnotrecognizedRecognizedoptionalattributesarepropagatedtootherneighborsbasedontheirmeaning(notconstrainedbytransitivebit),OptionalBGPAttributes(Cont.),NontransitiveattributesMulti-ExitDiscriminatorUsedtodiscriminatebetweenmultipleentrypointstoasingleautonomoussystemTransitiveattributesAggregatorSpecifiesIPaddressandASnumberoftherouterthatperformedrouteaggregationCommunity（为路由打上标记，对BGP/MPLSVPN的路由隔离有着极为重大的贡献）Usedforroutetagging,AS-PathAttribute（BGP中用来避免环路的最有效机制）,TheAS-pathattributeisemptywhenalocalrouteisinsertedintheBGPtableTheASnumberofthesenderisprependedtotheAS-pathattributewhentheroutingupdatecrossesASboundaryThereceiverofBGProutinginformationcanusetheAS-pathtodeterminethroughwhichAStheinformationhaspassedAnASthatreceivesroutinginformationwithitsownASnumberintheAS-pathsilentlyignorestheinformation,AS-PathAttribute(Cont.),AS-PathAttribute(Cont.),AS-PathAttribute(Cont.),Next-HopAttribute(到达下一个AS的最佳入口IP地址),TheIPaddressofthenextAStoreachagivennetwork:RouterAadvertisesnetwork172.16.0.0torouterBinEBGP,withanexthopof10.10.10.3RouterBadvertises172.16.0.0inIBGPtorouterC,keeping10.10.10.3asthenext-hopaddressThenext-hopattributeiswell-known,mandatory,andtransitive.,Next-HopAttribute(Cont.),Next-hopattributeisusuallysettotheIPaddressofthesendingrouter,Next-hopprocessing,Next-HopAttribute(Cont.),Next-hopprocessing,Next-hopattributeisusuallysettotheIPaddressofthesendingrouter,Next-HopAttribute(Cont.),IfthereceivingBGProuterisinthesamesubnetasthecurrentnext-hopaddress,thenext-hopaddressisnotchangedtooptimizepacketforwarding,Next-hopprocessingonsharedmedia,Next-HopAttribute(Cont.),Next-hopprocessingonsharedmedia,IfthereceivingBGProuterisinthesamesubnetasthecurrentnext-hopaddress,thenext-hopaddressisnotchangedtooptimizepacketforwarding,Next-HopAttribute(Cont.),BGPnext-hopprocessingcanbreakconnectivitywithimpropernetworkdesignsoverpartially-meshedWANnetworks,Next-hopprocessingonNBMAnetwork,Next-HopAttribute(Cont.),BGPnext-hopprocessingcanbreakconnectivitywithimpropernetworkdesignsoverpartially-meshedWANnetworks,Next-hopprocessingonNBMAnetwork,Example:next-hop-selfConfiguration,OriginAttribute(本地产生BGP路由的方式),IGP(i)networkcommandEGP(e)RedistributedfromEGPIncomplete(?)RedistributedfromIGPorstatic,TheoriginattributeinformsallAutonomousSystemsintheinternetworkhowtheprefixeswereintroducedintoBGP.Theoriginattributeiswell-known,mandatory,andtransitive.,LocalPreferenceAttribute,Thelocalpreferenceattributeiswell-known,discretionary,andispassedonlywithintheAS.,Pathswithhighestpreferencevaluearemostdesirable:LocalpreferenceisusedtoadvertisetoIBGPneighborsabouthowtoleavetheirAS.ThelocalpreferenceissenttoIBGPneighborsonly.,MultiexitDiscriminator(MED)Attribute,ThepathswiththelowestMED(alsocalledthemetric)valuearethemostdesirable:MEDisusedtoadvertisetoEBGPneighborshowtoexittheirAStoreachnetworksownedbythisAS.MEDissenttoEBGPneighborsonly.TheMEDattributeisoptionalandnontransitive.,WeightAttribute(Cisco-Only),Pathswithhighestweightvaluearemostdesirable.WeightnotsenttoanyBGPneighbors,BGPRouteSelection,TheBGPforwardingtableusuallyhasmultiplepathwaysfromwhichtochooseforeachnetwork.BGPisnotdesignedtoperformloadbalancing:Pathsarechosenbecauseofpolicy.Pathsarenotchosenbaseduponbandwidth.TheBGPselectionprocesseliminatesanymultiplepathwaysthroughattritionuntilasinglebestpathwayisleft.（纵向：根据attribute逐步筛选找到最佳的BGP路由）Thatbestpathwayissubmittedtotheroutingtablemanagerprocessandevaluatedagainstthemethodsofotherroutingprotocolsforreachingthatnetwork(administrativedistance).（和其他路由进行横向比较根据AD选出最佳路由送入路由表）Theroutingprotocolwiththelowestadministrativedistancewillbeinstalledintheroutingtable.,BuildingtheBGPTable,所有从邻居接收到的路由都会被放入BGP表（被过滤的除外）所有本地产生的路由也会被放入BGP表,BGPRouteSelectionCriteria(Cont.),BestroutestothedestinationnetworksareselectedfromtheBGPtable（根据attribute逐步筛选出来）,21.0.0.0应该选择3.4.5.6作为最佳路由,RouteSelectionDecisionProcess,Consideronly(synchronized)routeswithnoASloopsandavalidnexthop,andthen:Preferhighestweight(localtorouter)（思科私有属性）Preferhighestlocalpreference(globalwithinAS)Preferrouteoriginatedbythelocalrouter(nexthop=0.0.0.0)PrefershortestASpathPreferlowestorigincode(IGPEGPincomplete)PreferlowestMED(fromotherAS)PreferEBGPpathoverIBGPpathPreferthepaththroughtheclosestIGPneighborPreferoldestrouteforEBGPpathsPreferthepathwiththelowestneighborBGProuterID,BGPRoutePropagation,BestBGProutesarepropagatedtoBGPneighbors（自己未必会使用它，此路由未必会进入到路由表）,BuildingtheIPRoutingTable,BestBGProutesarecopiedintotheIProutingtablebasedonadministrativedistance,控制属性进行策略选路,Preferhighestweight(localtorouter)（思科私有属性）Preferhighestlocalpreference(globalwithinAS)PrefershortestASpathPreferlowestorigincode(IGPi192.168.28.110006500265003i*i172.24.0.0172.20.50.1100065005i*i192.168.28.1100065002650036500465005i*i172.30.0.0172.20.50.110006500565004i*i192.168.28.11000650026500365004i,默认情况下，C到达172.24.0.0以及172.30.0.0是选择172.20.50.1作为下一跳，因为此路由AS-Path长度最短,RouteMapforRouterA,RouterAsConfiguration:routerbgp65001neighbor2.2.2.2remote-as65001neighbor3.3.3.3remote-as65001neighbor2.2.2.2remote-as65001update-sourceloopback0neighbor3.3.3.3remote-as65001update-sourceloopback0neighbor192.168.28.1remote-as65002neighbor192.168.28.1route-maplocal_prefin!route-maplocal_prefpermit10matchipaddress65setlocal-preference400!route-maplocal_prefpermit20（此命令必须设置，如果没有此命令，路由器只会从邻居192.168.28.1接收172.30.0.0的路由）access-list65permit172.30.0.00.0.255.255,LocalPreferenceLearnedbyRouterC,RouterC#showipbgpBGPtableversionis7,localrouterIDis3.3.3.3Statuscodes:ssuppressed,ddamped,hhistory,*valid,best,i-internalOrigincodes:i-IGP,e-EGP,?-incompleteNetworkNextHopMetricLocPrfWeightPath*i172.16.0.0172.20.50.11000650056500465003i*i192.168.28.110006500265003i*i172.24.0.0172.20.50.1100065005i*i192.168.28.1100065002650036500465005i*i172.30.0.0172.20.50.110006500565004i*i192.168.28.14000650026500365004i,此时，到172.30.0.0的最佳BGP路由是选择192.168.28.1（较大的LOCALPREFERENCE）,其余的选路保持不变,控制属性进行策略选路AS-Path,2003,CiscoSystems,Inc.Allrightsreserved.,79,ReturnPathSelectioninaMultihomedAS,Requirement:thereturntrafficfromthecustomermustarriveoverthehighest-speedaccesslink,ReturnPathSelectioninaMultihomedAS,Requirement:thecustomersreturntrafficmustarriveoverthehighest-speedaccesslink,DefaultReturnPath,DefaultReturnPath,DefaultReturnPath,DefaultReturnPath,Result:thereturntrafficflowsoverthepathwiththeshortestAS-pathlength,ProperReturnPathSelection,Q:HowdoyouselecttheproperreturnpathfromAS387?A:UselocalpreferenceinAS387Q:WilltheadministratorofAS387configureit?A:Unlikely,BGPRouteSelectionRules,BGProuteselectionusesthefollowingcriteriaPreferlargestweightPreferlargestlocalpreferencePreferroutesthattherouteroriginatedPrefershorterASpathsOtherrouteselectionrulesManipulatingtheoutgoingAS-pathlengthcouldresultinproperreturnpathselection,AS-PathPrepending,ManualmanipulationofAS-pathlengthiscalledAS-pathprependingASpathshouldbeextendedwithmultiplecopiesoftheASnumberofthesenderAS-pathprependingisusedtoEnsureproperreturnpathselectionDistributethereturntrafficloadformultihomedcustomers,AS-PathPrepending(Cont.),Result:thereturntrafficflowsoverthedesiredreturnpath,AS-PathPrepending(Cont.),Result:thereturntrafficflowsoverthedesiredreturnpath,AS-PathPrepending(Cont.),Result:thereturntrafficflowsoverthedesiredreturnpath,AS-PathPrepending(Cont.),Result:thereturntrafficflowsoverthedesiredreturnpath,AS-PathPrepending(Cont.),Result:thereturntrafficflowsoverthedesiredreturnpath,AS-PathPrepending(Cont.),PrependtheASpathwiththeASnumberofthesender,nottheASnumberofthereceiver.,AS-PathPrepending(Cont.),PrependtheASpathwiththeASnumberofthesender,nottheASnumberofthereceiver.,AS-PathPrepending(Cont.),PrependtheASpathwiththeASnumberofthesender,nottheASnumberofthereceiver.,ConfiguringAS-PathPrepending,route-mapnamepermitsequencematchconditionsetas-pathprependas-numberas-number,router(config)#,PrependsthespecifiedASnumbersequencetotheroutesmatchedbytheroute-mapentryASnumbersareprependedtotheASpathfromtheBGPtable;theASnumberofthesenderisalwaysprependedtotheendresult,neighboraddressroute-mapnameout,router(config-router)#,Appliestheroute-maptooutgoingupdatessenttothespecifiedBGPneighbor,ConfiguringAS-PathPrepending(Cont.),控制属性进行策略选路MED,2003,CiscoSystems,Inc.Allrightsreserved.,99,BGPMulti-ExitDiscriminator:InboundMetric,default-metricnumber,Router(config-router)#,MEDisconsideredthemetricofBGP.Allr